Hold the change without losing the legitimate invoice
A supplier-change check should separate the underlying invoice from the new payment instruction. An invoice can describe real goods, the correct amount and a genuine purchase while the proposed beneficiary still needs verification. Keep the existing approved supplier details available and mark the new instruction as pending. This avoids silently replacing trusted data before anyone has confirmed the change.
Assign one person to own the pending update and identify any payment already scheduled against it. The purpose is to control the change, not automatically accuse the supplier or cancel legitimate work. If the deadline is close, tell the appropriate business owner why release is paused and which verification step is outstanding. Urgency needs a defined escalation route rather than an undocumented exception.
Use an established contact and confirm authority
The FBI's BEC guidance recommends independently verifying payment and account changes. For a business process, use contact details established before the questionable request. A number added to the new invoice, a replacement signature or a new chat contact belongs to the request being checked. It cannot independently establish its own legitimacy.
Confirm both the change and the person's authority to request it. A receptionist may verify that an employee exists without having authority over beneficiary details. Agree how the supplier's authorized contact and your own finance approver will confirm the proposed information using an appropriate secure channel. Do not read sensitive account information to an unverified incoming caller merely because they know the invoice number.
Record the change so another approver can review it
Use a short verification register alongside the normal supplier record. It should explain what changed, how the contact was found, who confirmed authority and who can release the update. The register is an original workflow aid, not a bank validation service. It does not establish account ownership by itself or replace the bank's controls and the business's own finance requirements.
Keep the record proportionate and access-controlled. Staff need a way to see that verification is complete without copying full bank details into an open chat. Separate the person who edits supplier data from the person who authorizes payment where the team can support it. If staffing makes separation difficult, document the alternate check rather than pretend a second approval happened.
| Decision field | Evidence to retain | Release condition |
|---|---|---|
| Requested change | Supplier, invoice context and affected beneficiary field. | The actual change is clearly identified. |
| Trusted contact | Origin of the previously held contact information. | The request did not supply its own verifier. |
| Supplier authority | Authorized person and confirmation route. | The person may approve this type of change. |
| Internal approval | Finance owner and backup approver. | Business approval is recorded separately. |
| Payment state | Pending, scheduled or already sent. | The correct bank or workflow action is taken. |
| Final update | Owner, time and affected supplier record. | Payment uses the reviewed information. |
Do not substitute email checks or a small transfer for approval
Sender-domain checks help assess the sending environment, but they do not authorize a beneficiary. A message arriving from an expected account still needs the supplier-change process. Finance should not be required to interpret raw email headers as its sole fraud control. The administrator can investigate an account concern while the finance owner independently verifies the business instruction.
A small successful payment also does not establish that the intended supplier controls the destination or that the change is authorized. Treat payment testing, bank checks and business approval as separate decisions with their own limits. Do not ask staff to improvise a transfer as a shortcut. Follow the financial provider's supported process and the organization's defined authority for changing sensitive master data.
If details were updated or money moved, branch the response
An unverified update with no transfer calls for controlling the supplier record and checking scheduled payments. A transfer already sent requires prompt contact with the genuine bank or payment provider. Explain the suspected fraud, provide the transaction reference through the provider's secure channel and follow its instructions. A technical enquiry is not the first dependency for that conversation.
Preserve the request, verification history and known payment status. Do not delay financial action while trying to prove whether a mailbox was compromised. If the email environment may be involved, assign a separate administrator to review it. Recovery prospects and reporting duties depend on the circumstances and jurisdiction; no technical provider can promise a successful bank recall from this guide.
Make the process workable during absence and busy periods
Review the route with finance and the people who maintain supplier data. Include deputies, time zones, staff departures and requests received outside the usual schedule. A short tabletop can reveal whether the team knows where trusted contacts are stored and who can authorize an exception. Test that handoff using fictional details rather than a live beneficiary change or deceptive message.
CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli technical knowledge. We can discuss business-email configuration, account permissions and related technical controls within an agreed scope. Payment approval remains with the business, and bank action stays with the genuine financial provider. We do not offer a fraud-recovery guarantee or present this technical guide as legal or banking advice.
